|Main Archive Page > Month Archives > syslog-ng-users archives|
2011/10/7 Gergely Nagy <email@example.com>
> Gbe gbe <firstname.lastname@example.org> writes:
> > Hi everyone !
> > I have this message in my logs repeated several times and for different
> > files :
> > « syslog-ng: The current log file has a mismatching size/inode
> > information, restarting from the beginning;
> > filename='/var/log/squid3/access.log' »
> This means that the file has changed. This can happen due to being
> truncated, rotated away, or hardware failiure.
> In most cases, it's the result of log rotation, though.
> syslog-ng keeps track of file positions, in order to be able to continue
> wherever it left when restarted. But for that to work reliably, it also
> stores the inode and size of the file, so it can detect when a file was
> changed, and restart from the beginning.
> This is exactly what happens in your case: some logs get rotated, and
> syslog-ng restarts reading from the beginning of said files.
> Nothing to worry about. At least, if you do have rotation set up, and
> the messages come shortly after rotation happens.
However, this machine has been up for several months (I don't mean the
uptime) and has never printed those messages. As far as I know the
configuration hasn't changed recently. This is why I start suspecting
hardware failure. Nothing else in the logs tells me about any hardware
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng